fuzz_dcerpc_parse_binding: don't leak

Also, by not tallocing at all in the too-long case, we can short
circuit quicker.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Oct 20 02:26:40 UTC 2020 on sn-devel-184

diff --git a/lib/fuzzing/fuzz_dcerpc_parse_binding.c b/lib/fuzzing/fuzz_dcerpc_parse_binding.c
index 5f1c68707ed1011f73e72344f5cffa4da2e7fc71..61df0c0670ef54b13fa211c03d1e0f82191f563a 100644 (file)
--- a/lib/fuzzing/fuzz_dcerpc_parse_binding.c
+++ b/lib/fuzzing/fuzz_dcerpc_parse_binding.c
@@ -26,7 +26,7 @@ char buf[MAX_LENGTH + 1];
 
 int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
 {
-       TALLOC_CTX *mem_ctx = talloc_new(NULL);
+       TALLOC_CTX *mem_ctx = NULL;
        struct dcerpc_binding *binding = NULL;
        struct dcerpc_binding *dup = NULL;
        struct epm_tower tower;
@@ -36,9 +36,11 @@ int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
        if (len > MAX_LENGTH) {
                return 0;
        }
+
        memcpy(buf, input, len);
        buf[len]  = '\0';
 
+       mem_ctx = talloc_new(NULL);
        status = dcerpc_parse_binding(mem_ctx, buf, &binding);
 
        if (! NT_STATUS_IS_OK(status)) {